AdCue Documentation

Security & Data Protection

Your ad accounts are safe with us

How AdCue protects your advertising accounts, credentials, and data, including OAuth scopes, encryption, retention, and compliance.

Our Security Principles

Connecting an advertising account requires trust. AdCue documents what it accesses, how credentials are stored, and which safeguards protect users.

Minimal Permissions

AdCue requests only the OAuth scopes needed to read and manage ad campaigns, never email or files.

Encrypted at Rest

Refresh and access tokens are encrypted with AES-256-GCM before storage.

No Raw Data Retention

Raw performance data is fetched when needed. Only aggregated scores and audit results are retained.

You Stay in Control

Disconnect accounts or delete your AdCue account at any time.

OAuth Scopes & Permissions

Google Ads

AdCue uses the Google Ads API v23 and the google-ads scope. It can read campaigns and perform changes you explicitly request, but cannot access Gmail, Drive, Calendar, or unrelated Google services.

Scope	What It Allows	What It Does NOT Allow
https://www.googleapis.com/auth/adwords	Read and manage Google Ads campaigns, ad groups, keywords, budgets, and conversion tracking.	Cannot access Gmail, Drive, YouTube, Calendar, or other non-Ads data.

Meta (Facebook) Ads

Scope	Purpose
ads_read	Read campaign performance data and metrics.
ads_management	Make changes you explicitly request.
pages_show_list	List connected Facebook Pages for attribution.
pages_read_engagement	Read page engagement metrics tied to ads.

MCP API Security

OAuth 2.0 with PKCE prevents token interception.
Dynamic Client Registration (RFC 7591) gives every client unique credentials.
Short-Lived Access Tokens expire after 1 hour, while refresh tokens last 30 days.
Consent Screen approval is required before access.
Token Hashing stores SHA-256 hashes instead of recoverable raw tokens.
Automatic Cleanup purges expired sessions, tokens, and authorization codes hourly.

How Credentials Are Stored

Encryption at rest

Every refresh token uses AES-256-GCM with a unique initialization vector.

Key separation

Encryption keys live in Vercel environment variables, separate from the Supabase database.

No plaintext logging

Redaction middleware strips tokens from logs, error reports, and analytics.

Decryption only at use time

Plaintext exists only in memory while an API request is active.

What Data We Store

Data	Stored?	Retention
Encrypted Google/Meta refresh tokens	Yes	Until disconnect or account deletion.
Health scores	Yes	Rolling 90-day history.
AI recommendations	Yes	Until applied, dismissed, or expired after 30 days.
Audit results	Yes	Until account deletion.
Raw campaign data	No	Fetched per request and not persisted.
Search term reports	No	Processed in memory.
Ad creative text or images	No	Never stored by AdCue.
Personal Google/Meta data	No	Never accessed or stored.

Infrastructure & Hosting

Frontend & API - Vercel US regions with TLS.
Database - Supabase PostgreSQL with Row Level Security.
Audit Microservice - Google Cloud Run in us-central1 with no persistent storage.
MCP Server - Google Cloud Run with OAuth at the gateway.
All traffic encrypted - HTTPS/TLS between every service.

Account Deletion & Data Removal

Deleting an AdCue account from Dashboard > Settings permanently removes:

Encrypted refresh tokens.
Health scores, recommendations, and audit history.
MCP tokens, sessions, and client registrations.
The active login session.

Deletion is irreversible. Meta Data Deletion Callback requests also trigger removal of Meta-related data.